OSGenome handles sensitive genetic data. This document outlines security measures and best practices.

• File uploads: Size limits (16MB), type validation, filename sanitization
• Base64 data: Validation before decoding, size checks
• Genetic data: Format validation, allele validation, rsid format checks
• Path traversal protection: All file paths sanitized using secure_filename()

• SNPedia crawler: 1 second delay between requests
• Retry logic: Exponential backoff on failures
• Request timeouts: 30 second timeout on HTTP requests
• Batch processing: Intermediate saves every 10 requests

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• X-XSS-Protection: 1; mode=block
• Strict-Transport-Security: max-age=31536000
• Content-Security-Policy: Restricts resource loading

• Secure session cookies (HTTPS only in production)
• HttpOnly cookies (prevents XSS access)
• SameSite cookies (CSRF protection)
• Secret key from environment variable

• No sensitive data in error messages
• Proper logging without exposing user data
• Graceful degradation on failures

• All data processed locally
• No external data transmission (except SNPedia API)
• No data persistence beyond user control

Create a .env file based on .env.example:

cp .env.example .env

Required for production:

• SECRET_KEY: Strong random key (use python -c "import os; print(os.urandom(32).hex())")
• FLASK_ENV=production
• FLASK_DEBUG=false

Ensure proper file permissions:

chmod 600 .env
chmod 700 data/

1. Never share your raw genetic data files
2. Use strong SECRET_KEY in production
3. Run behind HTTPS in production (use nginx/Apache as reverse proxy)
4. Keep dependencies updated: uv sync --upgrade
5. Review logs regularly for suspicious activity
6. Backup your data before processing

1. Never commit .env files (already in .gitignore)
2. Validate all user inputs
3. Use parameterized queries if adding database support
4. Keep dependencies minimal and audited
5. Run security scanners: uv add --group dev safety && uv run safety check
6. Follow OWASP guidelines

If you discover a security vulnerability:

1. DO NOT open a public issue
2. Email the maintainer directly (check README for contact)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Set strong SECRET_KEY environment variable
• Set FLASK_ENV=production
• Disable debug mode (FLASK_DEBUG=false)
• Use HTTPS (configure reverse proxy)
• Set proper file permissions
• Configure firewall rules
• Enable logging and monitoring
• Regular dependency updates
• Backup strategy in place
• Review CORS settings
• Test rate limiting

1. In-memory rate limiting: Resets on restart (consider Redis for production)
2. No authentication: Assumes single-user local deployment
3. No database encryption: Data stored as JSON files
4. CSP allows unsafe-inline: Required for inline scripts (consider refactoring to external JS file)

This security policy is reviewed and updated regularly. Last update: December 2, 2025

• OWASP Top 10
• Flask Security Best Practices
• Python Security